Answer in brief
CVE-2026-105455 records a Medium severity (CVSS 5.3) vulnerability in Stored XSS via related ticket subject on RTIR Split and Create Incident forms. The current sources do not mark it as known exploited. The current feed maps Best Practical Solutions/RT for Incident Response (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Best Practical Solutions/RT for Incident Response (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Best Practical Solutions/RT for Incident Responsegeneric | >=6.0.0 <6.0.4 | 6.0.4 |
Published upstream
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 30, 2026
RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, and they render that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject. The script then runs in the session of the incident handler who creates an incident from the report or splits it, and can act in RT with that user's authority. The issue was fixed in version 6.0.4. RTIR 5.0 is not affected.
Quoted source text, attributed separately from HOL analysis.